]>
Commit | Line | Data |
---|---|---|
00e5a55c BS |
1 | From: Gerald Schaefer <geraldsc@de.ibm.com> |
2 | Subject: sclp: handle zero-length event buffers | |
3 | References: bnc#477666,LTC#51641 | |
4 | ||
5 | Symptom: Support Element (SE) restart may cause Linux on LPAR to hang. | |
6 | Problem: During SE restart, some SE versions may under certain conditions | |
7 | present a malformed Read Event Data response block to Linux which | |
8 | causes an endless loop in function sclp_dispatch_evbufs. | |
9 | Solution: Stop event dispatching loop when a zero-length event buffer was | |
10 | recognized. | |
11 | ||
12 | Acked-by: John Jolly <jjolly@suse.de> | |
13 | ||
14 | --- | |
15 | drivers/s390/char/sclp.c | 5 ++++- | |
16 | 1 file changed, 4 insertions(+), 1 deletion(-) | |
17 | ||
18 | Index: linux-sles11/drivers/s390/char/sclp.c | |
19 | =================================================================== | |
20 | --- linux-sles11.orig/drivers/s390/char/sclp.c | |
21 | +++ linux-sles11/drivers/s390/char/sclp.c | |
22 | @@ -280,8 +280,11 @@ sclp_dispatch_evbufs(struct sccb_header | |
23 | rc = 0; | |
24 | for (offset = sizeof(struct sccb_header); offset < sccb->length; | |
25 | offset += evbuf->length) { | |
26 | - /* Search for event handler */ | |
27 | evbuf = (struct evbuf_header *) ((addr_t) sccb + offset); | |
28 | + /* Check for malformed hardware response */ | |
29 | + if (evbuf->length == 0) | |
30 | + break; | |
31 | + /* Search for event handler */ | |
32 | reg = NULL; | |
33 | list_for_each(l, &sclp_reg_list) { | |
34 | reg = list_entry(l, struct sclp_register, list); |